What you need to know about stalkerware | Eva Galperin

譯者: H_L Au 審譯者: NAN-KUN WU

I want you to travel back in time with me,

我想大家和我一起回到過去，

to the before time, to 2017.

回到之前的時間，到 2017 年。

I don't know if you can remember it,

我不知道你能否記起

dinosaurs were roaming the earth.

恐龍在地球上漫遊。

I was a security researcher,

我是個資安研究員，

I had spent about five or six years

我用了五或六年時間

doing research on the ways in which APTs,

做關於 APT 的研究，

which is short for advanced persistent threats,

即高級長期威脅的簡稱，

which stands for nation-state actors,

亦即是民族國家行動者

spy on journalists and activists

來監視記者、社會活動家、

and lawyers and scientists

律師、科學家，

and just generally people who speak truth to power.

還有對強權說真話的普通人。

And I'd been doing this for a while

我已經做了一段時間，

when I discovered that one of my fellow researchers,

才發現我其中一位研究員，

with whom I had been doing this all this time,

這段時間一直與我共事的這個人

was allegedly a serial rapist.

據稱是一名連續強姦犯。

So the first thing that I did

所以我第一件做的事

was I read a bunch of articles about this.

就是讀了很多相關的報導。

And in January of 2018,

而在 2018 年一月

I read an article with some of his alleged victims.

我讀到一些據稱 是他受害者的相關文章。

And one of the things that really struck me about this article

而有一點讓我很震驚，

is how scared they were.

就是她們有多害怕。

They were really frightened,

她們真的很驚慌，

they had, you know, tape over the cameras on their phones

她們用膠帶覆蓋手機的鏡頭，

and on their laptops,

筆電的也是。

and what they were worried about was that he was a hacker

她們擔心的是他是個駭客，

and he was going to hack into their stuff

而他會駭進她們的東西，

and he was going to ruin their lives.

他會毀了她們的生活。

And this had kept them silent for a really long time.

因此令她們沉默了很長的時期。

So, I was furious.

所以，我怒火中燒。

And I didn't want anyone to ever feel that way again.

我不想任何人再有那種感受。

So I did what I usually do when I'm angry:

所以我做了生氣時常做的事：

I tweeted.

在推特發文。

(Laughter)

（笑聲）

And the thing that I tweeted

而我的推文是

was that if you are a woman who has been sexually abused by a hacker

如果你是遭到駭客性侵犯的女性，

and that hacker has threatened to break into your devices,

而那個駭客威脅要駭入你的設備，

that you could contact me

你可以聯絡我，

and I would try to make sure

我會試著確保

that your device got a full, sort of, forensic look over.

你的設備得到了大致上 完整的鑑識科學檢查。

And then I went to lunch.

然後我就去吃午餐了。

(Laughter)

（笑聲）

Ten thousand retweets later,

然後被轉推了一萬次。

(Laughter)

（笑聲）

I had accidentally started a project.

我意外開始了一個計劃。

So every morning, I woke up and my mailbox was full.

每天早上，我起床的時候 信箱都是滿的，

It was full of the stories of men and women

充滿著男性和女性的故事，

telling me the worst thing that had ever happened to them.

告訴我發生在他們身上最壞的事。

I was contacted by women who were being spied on by men,

聯絡我的包括被男性監視的女性、

by men who were being spied on by men,

被男性監視的男性、

by women who were being spied on by women,

被女性監視的女性，

but the vast majority of the people contacting me

但是絕大多數與我聯繫的人

were women who had been sexually abused by men

是遭到男人性侵的女性，

who were now spying on them.

現在被他們監視著。

The one particularly interesting case

一個特別有趣的案例

involved a man who came to me,

是有個男人來找我，

because his boyfriend had outed him as gay

因為他男朋友向他極度保守的韓國家人

to his extremely conservative Korean family.

公開了他是個同性戀。

So this is not just men-spying-on-women issue.

因此，這不只是男性監視女性的問題。

And I'm here to share

我在此分享

what I learned from this experience.

從這經驗學到的事。

What I learned is that data leaks.

我學到的是資料會流出。

It's like water.

如水一樣。

It gets in places you don't want it.

會到你不想它到的地方。

Human leaks.

人會流出。

Your friends give away information about you.

你朋友會流出關於你的資訊，

Your family gives away information about you.

你家人會流出關於你的資訊。

You go to a party,

你參加派對，

somebody tags you as having been there.

有人標記了你在此。

And this is one of the ways

而這就是其中一個方法

in which abusers pick up information about you

令侵犯者得到

that you don't otherwise want them to know.

你不想他們得知的資訊。

It is not uncommon for abusers to go to friends and family

侵犯者到家人朋友那邊

and ask for information about their victims

以擔心受害人的「心理健康」為由，

under the guise of being concerned about their "mental health."

拿取受害人資訊的情況並不罕見。

A form of leak that I saw

我看到的一種流出形式

was actually what we call account compromise.

實際上就是我們所說的帳戶被盜用。

So your Gmail account,

你的 Gmail 帳戶、

your Twitter account,

你的推特帳戶、

your Instagram account,

你的 Instagram 帳戶、

your iCloud,

你的 iCloud 帳戶、

your Apple ID,

你的 Apple 帳戶、

your Netflix, your TikTok --

你的 Netflix、抖音——

I had to figure out what a TikTok was.

我查了才知道抖音是甚麼。

If it had a login,

只要需要登入帳戶，

I saw it compromised.

就有可能被盜用。

And the reason for that is because your abuser is not always your abuser.

因為侵犯者並不總是你的侵犯者。

It is really common for people in relationships to share passwords.

戀人之間分享密碼很常見。

Furthermore, people who are intimate,

此外，親密的人、

who know a lot about each other,

知道對方很多事的人，

can guess each other's security questions.

可以猜中對方的安全提問。

Or they can look over each other's shoulders

或是他們可以從背後偷看

to see what code they're using in order to lock their phones.

對方在用甚麼密碼解鎖手機。

They frequently have physical access to the phone,

他們很常可以接觸到那手機，

or they have physical access to the laptop.

或是他們可以接觸到那筆電。

And this gives them a lot of opportunity

這給了他們很多機會

to do things to people's accounts,

對別人的帳戶做很多事，

which is very dangerous.

而那是非常危險的。

The good news is that we have advice

好消息是我們對避免帳戶被盜用

for people to lock down their accounts.

提出了一些建議。

This advice already exists, and it comes down to this:

這個建議已經存在，它就是：

Use strong, unique passwords for all of your accounts.

所有帳戶都用強、獨特的密碼。

Use more strong, unique passwords

用更強、更獨特的密碼

as the answers to your security questions,

作為你安全問題的答案，

so that somebody who knows the name of your childhood pet

那麼那個知道你童年寵物名字的人

can't reset your password.

就不能重置你的密碼。

And finally, turn on the highest level of two-factor authentication

最後，打開你可以輕鬆使用的

that you're comfortable using.

最高級別的雙重身份驗證。

So that even if an abuser manages to steal your password,

因此就算侵犯者成功盜取密碼，

because they don't have the second factor,

因為他們沒有第二重認證，

就不能登入到你的帳戶。

they will not be able to log into your account.

The other thing that you should do

另一件你應該要做的事

is you should take a look at the security and privacy tabs

是你要看看安全和隱私頁面，

for most of your accounts.

所有的帳戶都一樣。

Most accounts have a security or privacy tab

大多帳戶都有安全和隱私頁面，

that tells you what devices are logging in,

它會告知你甚麼裝置登入了，

and it tells you where they're logging in from.

亦會各告知你登入的位置。

For example, here I am,

例如，我在這，

logging in to Facebook from the La Quinta,

由拉昆塔登入 Facebook，

where we are having this meeting,

也就是我們這次會議的地點，

and if for example,

而作為示範

I took a look at my Facebook logins

我看了 Facebook 的登入紀錄，

and I saw somebody logging in from Dubai,

看到有人從杜拜登入，

I would find that suspicious,

我會覺得那很可疑，

because I have not been to Dubai in some time.

因為我已經有一段時間沒去杜拜了。

But sometimes, it really is a RAT.

但有時，那其實是 RAT。

If by RAT you mean remote access tool.

RAT 就是遠端存取工具的意思。

And remote access tool

而遠端存取工具

is essentially what we mean when we say stalkerware.

本質上就是我們說的監控軟體。

So one of the reasons why getting full access to your device

能全面進入你的設備

is really tempting for governments

對政府來說這麼誘人的原因之一

is the same reason why getting full access to your device

就和能全面進入你的設備

is tempting for abusive partners and former partners.

對侵犯人的現任和前任伴侶 這麼誘人的原因一樣。

We carry tracking devices around in our pockets all day long.

我們整天攜帶著追蹤裝置。

We carry devices that contain all of our passwords,

我們攜帶的裝置有我們所有密碼，

all of our communications,

所有通訊，

including our end-to-end encrypted communications.

包括我們的端到端加密通訊。

All of our emails, all of our contacts,

所有電郵、所有聯絡人、

all of our selfies are all in one place,

所有我們的自拍都齊集一身，

often our financial information is also in this place.

有時我們的財務資料也在這。

And so, full access to a person’s phone

所以擁有一個人手機的完整權限，

is the next best thing to full access to a person's mind.

僅次於完全進入一個人的腦袋。

And what stalkerware does is it gives you this access.

而監控軟體的作用就是給你權限。

So, you may ask, how does it work?

那你可能會問，它怎樣做到？

The way stalkerware works

監控軟體的運作方式

is that it's a commercially available program,

就是個商業程式，

which an abuser purchases,

當侵犯者購買後

installs on the device that they want to spy on,

就安裝在他們想監控的裝置上，

usually because they have physical access

很常是因為他們能親自拿到，

or they can trick their target into installing it themselves,

或者誘騙他們的目標自己安裝。

by saying, you know,

像是說這樣的話，

「這個程式很重要，你應該要安裝。」

"This is a very important program you should install on your device."

And then they pay the stalkerware company

然後就付款給監控軟體公司

for access to a portal,

取得進入裝置的入口，

which gives them all of the information from that device.

來得到那裝置的所有資料。

And you're usually paying something like 40 bucks a month.

通常每月只要付 40 美元左右。

So this kind of spying is remarkably cheap.

所以真的超便宜。

Do these companies know

這些公司知道

that their tools

它們的軟體

are being used as tools of abuse?

被用作侵犯他人嗎？

Absolutely.

當然知道。

如果你看看 Cocospy 的行銷文案，

If you take a look at the marketing copy for Cocospy,

which is one of these products,

它其中一個產品

it says right there on the website

在網頁上寫著

that Cocospy allows you to spy on your wife with ease,

Cocospy 讓你輕易監控妻子，

"You do not have to worry about where she goes,

「不用擔心她的去向、

who she talks to or what websites she visits."

她的聊天對象和到訪的網站。」

So that's creepy.

令人毛骨悚然。

HelloSpy, which is another such product,

HelloSpy，另一個類似的產品，

had a marketing page in which they spent most of their copy

它們的行銷頁面有很大篇幅的文案

talking about the prevalence of cheating

在說明出軌有多層出不窮，

and how important it is to catch your partner cheating,

還有抓到伴侶出軌的重要性，

including this fine picture of a man

裡面還有個男人的照片，

who has clearly just caught his partner cheating

很明顯他抓到伴侶出軌，

and has beaten her.

然後痛打了她。

She has a black eye, there is blood on her face.

她一隻眼瘀青，臉上有血。

And I don't think that there is really a lot of question

我不用想也知道

about whose side HelloSpy is on in this particular case.

在這個例子中 HelloSpy 是站在哪一方的。

And who they're trying to sell their product to.

還有它們的銷售對象是誰。

It turns out that if you have stalkerware on your computer or on your phone,

事實證明很難知道監控軟體是否存在

it can be really difficult to know whether or not it's there.

你的電腦或手機裡。

And one of the reasons for that

而原因之一是

is because antivirus companies

防毒公司

often don't recognize stalkerware as malicious.

都不把監控軟體視為惡意軟體。

They don't recognize it as a Trojan

不視它作木馬

or as any of the other stuff that you would normally find

或是其他通常會

that they would warn you about.

警告你的東西。

These are some results from earlier this year from VirusTotal.

這些是 VirusTotal 今年稍早的部分結果。

I think that for one sample that I looked at

我看了一個例子，

I had something like a result of seven out of 60

然後結果只有六十分之七的平台

of the platforms recognized the stalkerware that I was testing.

認出我在測試的監控軟體。

And here is another one where I managed to get 10,

還有另一個成功達到十，

10 out of 61.

六十一分之十。

So this is still some very bad results.

那仍然是非常差的結果。

I have managed to convince a couple of antivirus companies

我成功說服幾家防毒公司

to start marking stalkerware as malicious.

開始把監控軟體標為惡意的。

So that all you have to do

如果你擔心它在你的電腦中，

if you're worried about having this stuff on your computer

那麼你要做的事

is you download the program,

就是下載程式，

you run a scan and it tells you

進行掃瞄，它就會告訴你

"Hey, there's some potentially unwanted program on your device."

「嗨，你的裝置上 有些你不想要的程式。」

It gives you the option of removing it,

它就會給你移除的選項，

but it does not remove it automatically.

但它不會自動刪除。

And one of the reasons for that

原因之一是因為

is because of the way that abuse works.

侵犯的運作方式。

Frequently, victims of abuse aren't sure

通常，受害者不知應否

whether or not they want to tip off their abuser

切斷侵犯者的進入權限，

by cutting off their access.

這就等於打草驚蛇了。

Or they're worried that their abuser is going to escalate to violence

或是擔心會升級為暴力，

or perhaps even greater violence

或是現有的暴力升級。

than they've already been engaging in.

Kaspersky was one of the very first companies

卡巴斯基是首間

that said that they were going to start taking this seriously.

認真對待這類事件的公司之一。

And in November of this year,

今年十一月

they issued a report in which they said

它們發表了一份報告，

that since they started tracking stalkerware among their users

自從開始為使用者探測監控軟體，

that they had seen an increase of 35 percent.

它們看到了 35% 的增長。

Likewise, Lookout came out with a statement

同樣，Lookout 也發表聲明

saying that they were going to take this much more seriously.

說要更加認真對待此事。

And finally, a company called Malwarebytes also put out such a statement

而最後 Malwarebytes 亦聲明

and said that they had found 2,500 programs

在它們尋找的期間，

它們找到了 2500 個

in the time that they had been looking,

which could be classified as stalkerware.

可歸類為監控軟體的程式。

Finally, in November I helped to launch a coalition

最後在十一月， 我幫忙成立了一個聯盟，

called the Coalition Against Stalkerware,

叫反監控軟體聯盟，

made up of academics,

由學者組成，

people who are doing this sort of thing on the ground --

還有實地在做這些事的人——

the practitioners of helping people to escape from intimate partner violence --

幫人擺脫親密伴侶暴力的從業人員，

and antivirus companies.

還有防毒軟體公司。

And our goal is both to educate people about these programs,

我們的目標是教育大家 有關這些程式的知識，

but also to convince the antivirus companies

還有說服防毒軟體公司

to change the norm

去改變常態，

in how they act around this very scary software,

改變它們應對這可怕軟體的手法。

so that soon, if I get up in front of you

那麼很快的，明年我再來這裡

and I talk to you about this next year,

站在你們眼前再說這件事的時候，

I could tell you that the problem has been solved,

我就可以告訴你們問題已經解決了，

and all you have to do is download any antivirus

而你們只要下載任何防毒軟體，

and it is considered normal for it to detect stalkerware.

它就會把偵測監控軟體視為理所當然，

That is my hope.

那就是我的期望。

Thank you very much.

多謝大家。

(Applause)

（掌聲）